b215d5e7cf39628497363e29d2dce0475e7180da848f7f6032d1187c78fd16bf

Analysis

Target

270a1s0ssssd7da.exe
Size

717KB
MD5

131a072bc700105a2c0ab9af7be6bd02
SHA1

43018d351cc5edd88dc6535113547e5fc1f02f60
SHA256

b215d5e7cf39628497363e29d2dce0475e7180da848f7f6032d1187c78fd16bf
SHA512

acfe259f69a3213a44f4cddd01397a336c951d984cd808d3e9c39486e3eec310b40d0baed24c1e089641920c1999e4b8d7888f408aebe5157d429ab4cd70748e

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	270a1s0ssssd7da.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1500	1056	270a1s0ssssd7da.exe	26
PID 1056 wrote to memory of 1500	1056	270a1s0ssssd7da.exe	26
PID 1056 wrote to memory of 1500	1056	270a1s0ssssd7da.exe	26
PID 1056 wrote to memory of 1500	1056	270a1s0ssssd7da.exe	26
PID 1056 wrote to memory of 1652	1056	270a1s0ssssd7da.exe	27
PID 1056 wrote to memory of 1652	1056	270a1s0ssssd7da.exe	27
PID 1056 wrote to memory of 1652	1056	270a1s0ssssd7da.exe	27
PID 1056 wrote to memory of 1652	1056	270a1s0ssssd7da.exe	27
PID 1056 wrote to memory of 1672	1056	270a1s0ssssd7da.exe	28
PID 1056 wrote to memory of 1672	1056	270a1s0ssssd7da.exe	28
PID 1056 wrote to memory of 1672	1056	270a1s0ssssd7da.exe	28
PID 1056 wrote to memory of 1672	1056	270a1s0ssssd7da.exe	28
PID 1056 wrote to memory of 1364	1056	270a1s0ssssd7da.exe	29
PID 1056 wrote to memory of 1364	1056	270a1s0ssssd7da.exe	29
PID 1056 wrote to memory of 1364	1056	270a1s0ssssd7da.exe	29
PID 1056 wrote to memory of 1364	1056	270a1s0ssssd7da.exe	29
PID 1056 wrote to memory of 1348	1056	270a1s0ssssd7da.exe	30
PID 1056 wrote to memory of 1348	1056	270a1s0ssssd7da.exe	30
PID 1056 wrote to memory of 1348	1056	270a1s0ssssd7da.exe	30
PID 1056 wrote to memory of 1348	1056	270a1s0ssssd7da.exe	30

C:\Users\Admin\AppData\Local\Temp\270a1s0ssssd7da.exe
"C:\Users\Admin\AppData\Local\Temp\270a1s0ssssd7da.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\270a1s0ssssd7da.exe
  "{path}"
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\270a1s0ssssd7da.exe
  "{path}"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\270a1s0ssssd7da.exe
  "{path}"
  2⤵
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\270a1s0ssssd7da.exe
  "{path}"
  2⤵
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\270a1s0ssssd7da.exe
  "{path}"
  2⤵
  PID:1348